In Microsoft Windows NT®, remote clients can read and write to files across the network. The LanManager redirector (RDR) implements the client side of the protocol for such activity by converting NT file system requests into SMB protocol (recently renamed CIFS by Microsoft) requests. These requests are then sent to the particular LanManager fileserver for processing. Microsoft's srv.sys is a kernel level operating system component that implements the server side of this interface. As such, srv.sys is not a file system, but rather a fileserver. A system running srv.sys can allow remote users to access any local file system data stored on that particular system.
Srv.sys comprises a network based interface and a file system based interface. The network based interface comprises the transport driver interface (TDI) layer and the network protocol drivers (e.g., a TCP/IP driver, a TCP/IPv6 driver or a NetBIOS over TCP/IP driver). Srv.sys communicates with remote computers through the network based interface.
The file system based interface is the corresponding interface with the local file system drivers that process the remote file I/O requests. Srv.sys communicates with local file system drivers such as ntfs.sys (the NT file system driver), msfs.sys (the mail slots file system driver) and npfs.sys (the named pipes files system driver) through the file system based interface.
Typically, srv.sys receives remote file I/O requests through the TDI interface, and then serves those requests through the file system interface. For example, in response to receiving a remote SMB request to create a file on an NTFS shared folder, srv.sys would issue a new IRP_MJ_CREATE request, and send it to the NT file system driver.
Correlating srv.sys network traffic with the corresponding file system traffic would enable many beneficial opportunities. For example, such correlation would allow identification of the remote computer and user issuing a remote file I/O request. This applies to all kinds of remote file I/O requests: write file to the local machine, read file from the local machine, query information of a file on the local machine, set information of a local file, query the security information of a local file, set the security information of a local file, etc.
There are three primary technical reasons why such correlation has not been achieved previously. The first reason is that all of the in-kernel interceptors of file I/O operations have been developed as either a file system filter driver or as an API interceptor for the kernel system services dispatch table functions, such as ZwCreateFile, ZwReadFile, ZwWriteFile, etc. Both techniques exist at the destination side of the file I/O request, and due to the in-kernel threading model (which includes native kernel threads, system worker threads and user mode threads), there is no readily discernable way to identify the remote requestor of the file system operation.
The second reason concerns the way in which srv.sys itself works. In order to save CPU cycles, srv.sys utilizes a concept of reusable interrupt request packets (IRPs). As such, srv.sys does not call the ZwXXXFile family of functions to request file I/O operations. Rather, srv.sys allocates IRPs by calling IoAllocateIrp and IoInitializelrp, and then reuses those IRPs without using the standard I/O manager services to create separate IRP structures for every file I/O request. Therefore, a kernel dispatch routines interceptor would miss those srv.sys file I/O requests.
The third reason is that most of the operations performed by high level device drivers inside the Windows NT kernel are not executed during the time the request is initiated within the original thread context. Instead, they are performed later by system worker threads. Thus, when srv.sys receives an SMB network request, srv.sys will queue a work item. The queued work item's context field will provide enough information to the callback function to implement the requested file I/O operations. The worker items are de-queued and executed within the context of an arbitrary system worker thread. Therefore, it is not readily feasible to know the network information associated with that specific SMB request since the thread context is already lost. This case is very common, since srv.sys is by definition a stateless network file sharing server, and as such is not required to maintain and manage any kind of state based information.
What is needed are methods, systems and computer readable media for correlating srv.sys network traffic with its corresponding file system activity.